WIP: Labels for Secrets

Merge pull request #59 from Lerentis/dependabot/github_actions/mikefarah/yq-4.40.5
Bump mikefarah/yq from 4.40.4 to 4.40.5
2024-01-06 14:10:45 +01:00 · 2023-12-18 20:47:12 +01:00 · 2023-12-18 20:47:02 +01:00 · 2023-12-18 06:20:53 +00:00 · 2023-12-18 06:20:36 +00:00 · 2023-12-11 17:49:35 +01:00
10 changed files with 171 additions and 16 deletions
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -36,7 +36,7 @@ jobs:
          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

      - name: Get app version from chart
-        uses: mikefarah/yq@v4.40.2
+        uses: mikefarah/yq@v4.40.5
        id: app_version
        with:
          cmd: yq '.appVersion' charts/bitwarden-crd-operator/Chart.yaml
@ -77,7 +77,7 @@ jobs:
        uses: WyriHaximus/github-action-get-previous-tag@v1

      - name: Download SBOM from github action
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
        with:
          name: ${{ env.ANCHORE_SBOM_ACTION_PRIOR_ARTIFACT }}

--- a/.github/workflows/test-and-lint.yml
+++ b/.github/workflows/test-and-lint.yml
@ -16,7 +16,7 @@ jobs:
        with:
          version: v3.11.2

-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@v5
        with:
          python-version: '3.9'
          check-latest: true
--- a/4
+++ b/4
@ -1,4 +1,4 @@
-FROM alpine:3.18.3
+FROM alpine:3.18.4

 LABEL org.opencontainers.image.source=https://github.com/Lerentis/bitwarden-crd-operator
 LABEL org.opencontainers.image.description="Kubernetes Operator to create k8s secrets from bitwarden"
@ -7,7 +7,7 @@ LABEL org.opencontainers.image.licenses=MIT
 ARG PYTHON_VERSION=3.11.6-r0
 ARG PIP_VERSION=23.1.2-r0
 ARG GCOMPAT_VERSION=1.1.0-r1
-ARG LIBCRYPTO_VERSION=3.1.2-r0
+ARG LIBCRYPTO_VERSION=3.1.3-r0
 ARG BW_VERSION=2023.1.0

 COPY requirements.txt /requirements.txt
--- a/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml
+++ b/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml
@ -14,7 +14,7 @@ spec:
      - bws
  versions:
    - name: v1beta4
-      served: true
+      served: false
      storage: true
      schema:
        openAPIV3Schema:
@ -49,3 +49,55 @@ spec:
                - id
                - namespace
                - name
+    - name: v1beta5
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                content:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      element:
+                        type: object
+                        properties:
+                          secretName:
+                            type: string
+                          secretRef:
+                            type: string
+                          secretScope:
+                            type: string
+                        required:
+                          - secretName
+                id:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      json:
+                        x-kubernetes-preserve-unknown-fields: true
+                        type: object
+                        properties:
+                          spec:
+                            type: object
+                            properties:
+                              foo:
+                                type: string
+                              bar:
+                                type: string
+              required:
+                - id
+                - namespace
+                - name
--- a/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml
+++ b/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml
@ -14,7 +14,7 @@ spec:
      - bwt
  versions:
    - name: v1beta4
-      served: true
+      served: false
      storage: true
      schema:
        openAPIV3Schema:
@ -36,3 +36,42 @@ spec:
                - template
                - namespace
                - name
+    - name: v1beta5
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                filename:
+                  type: string
+                template:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      json:
+                        x-kubernetes-preserve-unknown-fields: true
+                        type: object
+                        properties:
+                          spec:
+                            type: object
+                            properties:
+                              foo:
+                                type: string
+                              bar:
+                                type: string
+              required:
+                - filename
+                - template
+                - namespace
+                - name
--- a/charts/bitwarden-crd-operator/crds/registry-credentials.yaml
+++ b/charts/bitwarden-crd-operator/crds/registry-credentials.yaml
@ -14,7 +14,7 @@ spec:
      - rgc
  versions:
    - name: v1beta4
-      served: true
+      served: false
      storage: true
      schema:
        openAPIV3Schema:
@ -42,3 +42,48 @@ spec:
                - usernameRef
                - passwordRef
                - registry
+    - name: v1beta5
+      served: true
+      storage: true
+      schema:
+        openAPIV3Schema:
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                usernameRef:
+                  type: string
+                passwordRef:
+                  type: string
+                registry:
+                  type: string
+                id:
+                  type: string
+                namespace:
+                  type: string
+                name:
+                  type: string
+                labels:
+                  type: array
+                  items:
+                    type: object
+                    properties:
+                      json:
+                        x-kubernetes-preserve-unknown-fields: true
+                        type: object
+                        properties:
+                          spec:
+                            type: object
+                            properties:
+                              foo:
+                                type: string
+                              bar:
+                                type: string
+              required:
+                - id
+                - namespace
+                - name
+                - usernameRef
+                - passwordRef
+                - registry
--- a/example.yaml
+++ b/example.yaml
@ -1,5 +1,5 @@
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta4"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
 kind: BitwardenSecret
 metadata:
  name: test
@ -16,8 +16,10 @@ spec:
  id: "88781348-c81c-4367-9801-550360c21295"
  name: "test-secret"
  namespace: "default"
+  labels:
+    - key: value
 ---
-apiVersion: "lerentis.uploadfilter24.eu/v1beta4"
+apiVersion: "lerentis.uploadfilter24.eu/v1beta5"
 kind: BitwardenSecret
 metadata:
  name: test-scope
@ -29,4 +31,6 @@ spec:
        secretScope: fields
  id: "466fc4b0-ffca-4444-8d88-b59d4de3d928"
  name: "test-scope"
-  namespace: "default"
+  namespace: "default"
+  labels:
+    - key: value
--- a/src/dockerlogin.py
+++ b/src/dockerlogin.py
@ -44,6 +44,7 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
    id = spec.get('id')
    secret_name = spec.get('name')
    secret_namespace = spec.get('namespace')
+    labels = spec.get('labels')

    unlock_bw(logger)
    logger.info(f"Locking up secret with ID: {id}")
@ -55,9 +56,13 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
        "managed": "registry-credential.lerentis.uploadfilter24.eu",
        "managedObject": f"{namespace}/{name}"
    }
+
+    if not labels:
+        labels = {}
+
    secret = kubernetes.client.V1Secret()
    secret.metadata = kubernetes.client.V1ObjectMeta(
-        name=secret_name, annotations=annotations)
+        name=secret_name, annotations=annotations, labels=labels)
    secret = create_dockerlogin(
        logger,
        secret,
@ -66,7 +71,7 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs):
        password_ref,
        registry)

-    obj = api.create_namespaced_secret(
+    api.create_namespaced_secret(
        secret_namespace, secret
    )

--- a/src/kv.py
+++ b/src/kv.py
@ -41,6 +41,7 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
    id = spec.get('id')
    secret_name = spec.get('name')
    secret_namespace = spec.get('namespace')
+    labels = spec.get('labels')

    unlock_bw(logger)
    logger.info(f"Locking up secret with ID: {id}")
@ -52,12 +53,16 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
        "managed": "bitwarden-secret.lerentis.uploadfilter24.eu",
        "managedObject": f"{namespace}/{name}"
    }
+
+    if not labels:
+        labels = {}
+
    secret = kubernetes.client.V1Secret()
    secret.metadata = kubernetes.client.V1ObjectMeta(
-        name=secret_name, annotations=annotations)
+        name=secret_name, annotations=annotations, labels=labels)
    secret = create_kv(secret, secret_json_object, content_def)

-    obj = api.create_namespaced_secret(
+    api.create_namespaced_secret(
        namespace="{}".format(secret_namespace),
        body=secret
    )
--- a/src/template.py
+++ b/src/template.py
@ -33,6 +33,7 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
    filename = spec.get('filename')
    secret_name = spec.get('name')
    secret_namespace = spec.get('namespace')
+    labels = spec.get('labels')

    unlock_bw(logger)

@ -42,9 +43,13 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs):
        "managed": "bitwarden-template.lerentis.uploadfilter24.eu",
        "managedObject": f"{namespace}/{name}"
    }
+
+    if not labels:
+        labels = {}
+
    secret = kubernetes.client.V1Secret()
    secret.metadata = kubernetes.client.V1ObjectMeta(
-        name=secret_name, annotations=annotations)
+        name=secret_name, annotations=annotations, labels=labels)
    secret = create_template_secret(logger, secret, filename, template)

    obj = api.create_namespaced_secret(
Author	SHA1	Message	Date
Tobias Trabelsi	1d147aad9a	WIP: Labels for Secrets	2024-01-06 14:10:45 +01:00
Tobias Trabelsi	e31899b7f2	Merge pull request #59 from Lerentis/dependabot/github_actions/mikefarah/yq-4.40.5 Bump mikefarah/yq from 4.40.4 to 4.40.5	2023-12-18 20:47:12 +01:00
Tobias Trabelsi	116c1d9c4e	Merge pull request #58 from Lerentis/dependabot/github_actions/actions/download-artifact-4 Bump actions/download-artifact from 3 to 4	2023-12-18 20:47:02 +01:00
dependabot[bot]	0e08d3cc5e	Bump mikefarah/yq from 4.40.4 to 4.40.5 Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.4 to 4.40.5. - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](https://github.com/mikefarah/yq/compare/v4.40.4...v4.40.5) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-18 06:20:53 +00:00
dependabot[bot]	a58f4762d9	Bump actions/download-artifact from 3 to 4 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3 to 4. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v3...v4) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-18 06:20:36 +00:00
Tobias Trabelsi	f287bd80a1	Merge pull request #56 from Lerentis/dependabot/github_actions/mikefarah/yq-4.40.4 Bump mikefarah/yq from 4.40.3 to 4.40.4	2023-12-11 17:49:35 +01:00
Tobias Trabelsi	17fdd4a977	Merge pull request #57 from Lerentis/dependabot/github_actions/actions/setup-python-5 Bump actions/setup-python from 4 to 5	2023-12-11 17:49:17 +01:00
dependabot[bot]	2fde884ad5	Bump actions/setup-python from 4 to 5 Bumps [actions/setup-python](https://github.com/actions/setup-python) from 4 to 5. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/setup-python dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-11 06:40:27 +00:00
dependabot[bot]	cf186e84fb	Bump mikefarah/yq from 4.40.3 to 4.40.4 Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.3 to 4.40.4. - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](https://github.com/mikefarah/yq/compare/v4.40.3...v4.40.4) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-12-04 06:48:49 +00:00
Tobias Trabelsi	bf5a0b2484	Merge pull request #55 from Lerentis/dependabot/github_actions/mikefarah/yq-4.40.3 Bump mikefarah/yq from 4.40.2 to 4.40.3	2023-11-27 07:52:18 +01:00
dependabot[bot]	3ba8f49b39	Bump mikefarah/yq from 4.40.2 to 4.40.3 Bumps [mikefarah/yq](https://github.com/mikefarah/yq) from 4.40.2 to 4.40.3. - [Release notes](https://github.com/mikefarah/yq/releases) - [Changelog](https://github.com/mikefarah/yq/blob/master/release_notes.txt) - [Commits](https://github.com/mikefarah/yq/compare/v4.40.2...v4.40.3) --- updated-dependencies: - dependency-name: mikefarah/yq dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2023-11-27 06:48:53 +00:00